____ _ _ _ _ / ___| _| |__ ___ _ __| | __ _ _ __ __| (_) | | | | | | '_ \ / _ \ '__| | / _` | '_ \ / _` | | | |__| |_| | |_) | __/ | | |__| (_| | | | | (_| | | \____\__, |_.__/ \___|_| |_____\__,_|_| |_|\__,_|_| |___/ 

Hey, I'm Yohan 👋

Blue Team Practitioner | Detection Engineering · SOC Operations

---

I design, build, and validate detection systems — from architecture to alert.

Most of my work is hands-on: I build lab environments, write detection rules from real-world traffic, and document everything — including failures. My focus is understanding how attacks actually look in network data and how to detect them before the attacker gains a foothold.

---

🛠️ Tools & Technologies

---

🔬 Operation PCAP Autopsy — Detection Rule Development & Network Forensics

PCAP-based investigation series. Each operation analyzes real-world malware traffic, reconstructs the attack chain, and produces validated Suricata detection rules.

Operation	Title	Malware Family	Rules	Status
PA-01	You Dirty Rat!	STRRAT	3 Suricata	✅ Complete
PA-02	Lumma in the Room-ah	Lumma Stealer	13 Suricata	✅ Complete
PA-03	The Ghost in the Wire	GhostWeaver RAT	16 Suricata + 3 Sigma	✅ Complete

32 Suricata rules validated across 3 operations. 3 Sigma rules identified and deferred to Operation Prism Box.

---

🏗️ Operation Iron Watch — SOC Architecture & Detection Labs

A three-part SOC lab series. Each operation builds on the last: from manual detection to SIEM to full DMZ architecture with proactive defense.

Operation	Focus	Status
IW01	Foundational SOC — Snort IDS, manual correlation	✅ Complete
IW02	Graylog SIEM — web enumeration detection, SSH compromise invisible	✅ Complete
IW03	DMZ hardening, full log pipeline, DDoS Detection Suite	✅ Complete

---

🔮 Operation Prism Box — SIEM + EDR + Detection Correlation (Coming Soon)

Elastic Stack SIEM + Suricata IDS/IPS + Elastic Defend EDR + Atomic Red Team + Shuffle SOAR. Proactive detection methodology — writing Sigma + Suricata rules from simulated attack scenarios with cross-telemetry correlation.

Phase	Focus	Status
PB-01	Elastic Stack install + EDR implementation	🔜 Planned
PB-02	Atomic Red Team attack scenarios, Sigma + Suricata rule development	🔜 Planned
PB-03	Hardening, full detection suite, Shuffle SOAR + playbook automation	🔜 Planned

---

🔗 Links

---

I design, build, and validate detection systems — from architecture to alert.